Virtual Private Cloud:Use resource management to share IPAM pools

Overview

Resource sharing

Resource sharing is a handy feature for a multi-account architecture where certain cloud resources are centrally managed by an account or resources experience a low utilization rate. With the resource sharing feature, you can share these resources with other Alibaba Cloud accounts in the following ways:

• Share the resources from one Alibaba Cloud account with another.

• Share the resources by using the resource directory if a company centrally manages corporate accounts in a resource directory.

  • Share resources of a member in the resource directory with an external account.

  • Share resources of a member in the resource directory with a resource directory, a resource folder, or other members.

IPAM pool sharing

The owner of an IPAM pool can share the pool with other Alibaba Cloud accounts, known as principals. Principals can allocate resources from the shared IPAM pool when creating a virtual private cloud (VPC).

IPAM pools can currently be shared with Alibaba Cloud accounts (primary accounts) in the same business organization, as well as any Alibaba Cloud accounts (primary accounts).

Scenarios

• Resource sharing in the corporate network: Administrators can centrally plan IP addresses and share different address pools with business teams. This prevents address conflicts through efficient address allocation and management.

• Resource sharing across accounts: Existing IPAM pools can be shared with other Alibaba Cloud accounts for unified address planning and management across accounts. This ensures independent IP addresses for network connection.

Limits

After an IPAM pool is shared with the principal, the resource owners and principals have the following permissions on the shared pool:

Prerequisites

IPAM and IPAM pools are created. For more information, see Create and manage an IPAM and Create and manage an IPAM pool.

Procedure

Step 1: Resource owner shares IPAM pools in resource management

1. Log on to the account of the resource owner and navigate to the IPAM management console.

2. On the top navigation bar, select the region in which IPAM pool resides. In the left-side navigation pane, click IPAM Pool.

3. On the IPAM Pool page, use one of the following ways to configure.

   • Find the IPAM pool that you intend to configure and click instance ID.

   • Find the IPAM pool and click Manage in the Actions column.

4. Click the Sharing Management tab, then click Create Resource Share.

5. On the Create Resource Share page, complete the resource sharing configuration by following the steps.

   1. Set Resources to IPAM Pool and select the IPAM pool you want to share.

   2. The associated permission is AliyunRSDefaultPermissionIpamPool for the IPAM pool.

      Actions allowed by AliyunRSDefaultPermissionIpamPool

      vpc:CreateVpc
      vpc:AssociateVpcCidrBlock
      vpc:ListIpamPools
      vpc:ListIpamPoolCidrs
      vpc:CreateIpamPoolAllocation
      vpc:DeleteIpamPoolAllocation
      vpc:ListIpamPoolAllocations

   3. On the Add Principals page, enter the Principal ID.

Step 2: Principals allocate resources from the shared IPAM pool

Principals accept the sharing invitation

1. Log on to the account of the resource users and navigate to Resource management console.

2. In the left-side navigation pane, click Resource Sharing > Resources Shared To Me.

3. On the Shared By Me page, find the target resource share and click Accept in the Status column. In the Accept Resource Sharing Invitation dialog box, click OK.

Allocate resources from the shared IPAM pool and create VPC

1. Log on to the principal account and navigate to the VPC console.

2. On the VPC page, click Create VPC.

3. For the IPv4 CIDR Block, select IPv4 CIDR Block allocated by IPAM. In Select Pool, choose the shared IPAM pool.

What to do next (optional)

References

• For more information about the IPAM resource sharing quota, see Quota limits.

• For more information about the scenarios, concepts, and limits of resource sharing, see Resource Sharing overview.